Orica's Internal Control Framework

The Board ultimately has responsibility for internal compliance and control. The Board Audit and Risk Committee (“BARC”) has responsibility for ensuring that internal control systems are in place to monitor and manage risk.

Orica’s internal compliance and control system is based on the following:

• Embedded business controls – business management is responsible for the implementation of transactional and process controls.
• Oversight controls – the corporate centre overlays those transactional and process controls with a suite of monitoring controls.
• Independent monitoring and assurance – internal and external specialists, including Internal Audit, operate independently of the Business and Corporate Centre to provide stakeholders with assurance that key internal controls and business processes are designed and operating effectively and efficiently.

Set out below is a summary of some of the features of Orica’s internal compliance and control systems.

Embedded Business Controls

• Policies and procedures.
• Segregation of duties.
• Reconciliation procedures.
• User access restrictions.
• Delegations of Authority and Transaction Limites.
• System configuration and data integrity.
• Maintenance of records.
• Compliance and training.
•  Clear roles and responsibilities.
• Operational management review and oversight (including periodic reporting).
• Self assessment.

Oversight Controls

• Enterprise risk management program.
• Deliver the Promise and Code of Conduct.
• Organisational structure and reporting lines.
• Reserved powers and Delegation of Authority.
• Safety, health & environment functional oversight, training and audit.
• Finance functional oversight.
• Letters of assurance.
• Treasury and taxation management.
• Balance sheet reviews.

Independent Monitoring and Assurance

• Internal Audit: The internal audit function is delivered through a collaborative resource model utilising both internal and external resources.  The BARC is responsible for approving the appointment of the external provider of internal audit services and for approving the annual internal audit plan. The BARC meets with the internal auditor on a regular basis without management being present.
• External Audit: Financial Reporting and associated controls are subject to examination during the annual audit and half-year review undertaken by the external auditor.
• Specialist Assurance Providers.
• Regulatory reviews and Audits.